URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2025-08-24 01:23:58	52.223.13.41	a74e89cf4458da039.awsglobalaccelerator.com	Not listed	AS16509 AMAZON-02	US	no
2020-09-02 03:33:21	107.154.163.143	107.154.163.143.ip.incapdns.net	Not listed	AS19551 INCAPSULA	US	no
2020-08-12 12:52:10	104.28.12.83		Not listed	AS13335 CLOUDFLARENET	NU	no
2020-08-12 12:52:10	104.28.13.83		Not listed	AS13335 CLOUDFLARENET	TH	no
2020-08-12 12:52:10	172.67.133.49		Not listed	AS13335 CLOUDFLARENET	n/a	no

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-08-12 12:52:10	http://www.bretcadle.com/ftpcadlebe/esp/n4vle6w...	Offline	doc emotet epoch2 heodo	spamhaus

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-08-12 14:21:32	4020a8982e70b51b150cd40a837ea5dfceb35f0a6c9f9858b3fae5e00404ae62	doc		Heodo
2020-08-12 14:05:04	5039852e09153172ff5ef82c3e169e6a8c73a0b9f50c3ccdfac9773c3918bc09	doc		Heodo
2020-08-12 13:44:53	801b894083a28702abb0010b0d8c0fdbdb840c5ca75143f0b3651ffcd9f4733c	doc		Heodo
2020-08-12 13:33:53	56fb7bd9a61fd2c723055aa379f92c87b134c376217c523d018b8be2dce01300	doc		Heodo
2020-08-12 12:52:09	7d7fb59c83b591e7bbc1393505e7e7028366a98b25036a5ae565ceb46e40a153	doc		Heodo